Usable Security – CS 6204 – Fall, 2009 – Dennis Kafura – Virginia Tech Semantic Web Policy Systems Presented By: John Paul Dunning Usable Security – CS 6204 – Fall, 2009 – Dennis Kafura – Virginia Tech

Semantic Web Policy Systems “A meta-control architecture for orchestrating policy enforcement across heterogeneous information sources” Jinghai Rao, Alberto Sardinha, Norman Sadeh Carnegie Mellon University Usable Security – CS 6204 – Fall, 2009 – Dennis Kafura – Virginia Tech

Overview Context-sensitive security and privacy policies Decentralized trust management Challenges include:  sources of information vary from one principal to another  sources of information may vary over time  sources of information may not be known ahead of time Usable Security – CS 6204 – Fall, 2009 – Dennis Kafura – Virginia Tech

Contributions of Paper “Development of a semantic web framework and a meta-control model for opportunistically interleaving policy reasoning and web service discovery to enforce context-sensitive policies” Extension of XACML ontology Language independent system

Usable Security – CS 6204 – Fall, 2009 – Dennis Kafura – Virginia Tech XACML “XACML is an initiative to develop a standard for access control and authorization systems... XACML aims to achieve the following:  Create a portable and standard way of describing access control entities and their attributes.  Provide a mechanism that offers much finer granular access control than simply denying or granting access -- that is, a mechanism that can enforce some before and after actions along with "permit" or "deny" permission.”

Usable Security – CS 6204 – Fall, 2009 – Dennis Kafura – Virginia Tech Information Disclosure Agent (IDA) Policy Enforcement Agent (PEA) Controls access to information and service access through policies Uses policy enforcement  Control policies  Obfuscation policies

Usable Security – CS 6204 – Fall, 2009 – Dennis Kafura – Virginia Tech Information Disclosure Agent (IDA) Interact across various networks Encrypted traffic Language Independent (with interpreter)‏

Usable Security – CS 6204 – Fall, 2009 – Dennis Kafura – Virginia Tech Information Disclosure Agent (IDA)

Usable Security – CS 6204 – Fall, 2009 – Dennis Kafura – Virginia Tech Meta-Controller Monitors progress and determines the next step Cycle Meta-Control Housekeeping Module Modules complete tasks

Usable Security – CS 6204 – Fall, 2009 – Dennis Kafura – Virginia Tech Meta-Controller Query status information includes:  A query status ID  Status predicates  A query ID and query element ID  A parent query status ID  A time stamp

Usable Security – CS 6204 – Fall, 2009 – Dennis Kafura – Virginia Tech Meta-Controller

Usable Security – CS 6204 – Fall, 2009 – Dennis Kafura – Virginia Tech

Policy Reasoner Evaluating relevant policies Return policy decisions Modules:  Query Decomposition Module  Access Control Module  Obfuscation Module

Usable Security – CS 6204 – Fall, 2009 – Dennis Kafura – Virginia Tech Information Collector Gathering facts Modules:  Local Information Reasoner  Service Discovery Module  Service Invocation Module  User Interface

Usable Security – CS 6204 – Fall, 2009 – Dennis Kafura – Virginia Tech Service Discovery and Invocation IDAs are constantly sending queries and results back and forth Multiple queries between IDAs Node deadlock is possible and avoidable  Time outs  Query dependency graphs

Usable Security – CS 6204 – Fall, 2009 – Dennis Kafura – Virginia Tech Example Scenario Bob is an employee of SATElectronics Corporation Bob contracts to United GenSat Bob wants the schedule for deployment of SAT 777 from United GenSat, which is a product he has been working on.

Usable Security – CS 6204 – Fall, 2009 – Dennis Kafura – Virginia Tech Example Scenario

Usable Security – CS 6204 – Fall, 2009 – Dennis Kafura – Virginia Tech Beyond Access Control Policies

Usable Security – CS 6204 – Fall, 2009 – Dennis Kafura – Virginia Tech Q&A How easy are the policies to create/update/delete? What is the overhead of this system VS a standard form of authentication?